EVENT DETECTION IN TIME SERIES OF MOBILE COMMUNICATION GRAPHS
Leman Akoglu Christos Faloutsos
MOTIVATION
Cyber warfare Network intrusion Epidemic outbreaks Fault detection in
engineering systems
Anomaly and event (change-point) detection, is the building block for many applications:
2 of 20Leman Akoglu
DATA DESCRIPTION
Texting interactions of mobile phone users from a phone service company in a large city in India
who-texts-whom network edge-weighted: #SMS
>2 million customers 50 million SMS interactions Dec. 1, 2007 to May 31,
20083 of 20
Leman Akoglu
PROBLEM STATEMENTGiven a graph that changes over time, can we identify: 1) “change detection”: time points at which
many of the N nodes change their behavior significantly?
2) “attribution”: top k nodes which contribute to the change in behavior the most?
4 of 20Leman Akoglu
PROBLEM STATEMENT
Two main considerations: N is very large (on the order of 106)
monitoring each node independently is not practical.
“Anomaly” is defined in a collective setting a time-point/node is anomalous if
different than “others”
5 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
6 of 20Leman Akoglu
FEATURE EXTRACTION
Extract features from egonets for all nodes 1. Indegree/outdegree2. Inweight/outweight3. Number of neighbors4. Number of edges5. Reciprocal degree6. …
egonet
7 of 20Leman Akoglu
DATA IN 3-DNodes (>2 million)
Time(183 days)
Features (12)
8 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
9 of 20Leman Akoglu
DERIVING “EIGEN-BEHAVIOR”
N
T
F
T
N
T
N
F:inweight
W
principal eigenvector“typical behavior”“eigen-behavior”
active node high scoree.g. nodes 1, 2, 6
N
10 of 20Leman Akoglu
OVERVIEW OF OUR METHOD
1. Extract features for nodes2. Derive the typical behavior
(“eigen-behavior”) of nodes3. Compare “eigenbehavior”s over
time
11 of 20Leman Akoglu
TRACKING “BEHAVIOR” OVER TIMEN
T
F
T
N
T
N
F:inweight
WW
past pattern
eigen-behavior at tchange metric:
angle θ eigen-behaviors
N
12 of 20Leman Akoglu
DETECTED CHANGE POINTSEX
PER
IMEN
TS
F:inweight
Christian New Year
“back to work”
Hindi New Year
13 of 20Leman Akoglu
DETECTED CHANGE POINTS
F: reciprocal degree
EX
PER
IMEN
TSF: out-degree
Similar behavior for other features
14 of 20Leman Akoglu
PROBLEM STATEMENT
Given a graph that changes over time, can we identify: 1) “change detection”: time points at which
many of the N nodes change their behavior significantly?
2) “attribution”: top k nodes which contribute to the change in behavior the most?
15 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EX
PER
IMEN
TS
F:inweightDEC 26
no change
zone
u(t)
r(t-1)
16 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EX
PER
IMEN
TS
Time series of top 5 nodes marked
26 DEC
26 DEC
time (days)
#
SM
S r
eceiv
ed
17 of 20Leman Akoglu
ATTRIBUTING CHANGE TO NODES
EX
PER
IMEN
TS
JAN 2 “back to work”
re
cip
rocal
deg
ree
time (days)
18 of 20Leman Akoglu
CONCLUSION
An algorithm based on tracking “eigenbehavior” patterns over time “change detection”: spot time-points at
which “behavior” changes significantly “attribution”: spot nodes that cause the
most change Experiments: on real, SMS messages,
2M users, over 6 months
19 of 20Leman Akoglu
THANK YOU
www.cs.cmu.edu/~lakogluEmail: [email protected]
26 DECChristian New Year
“back to work”
Hindi New Year
change detection attribution20 of 20
Leman Akoglu
Top Related